conducting-spearphishing-simulation-campaign
Spearphishing simulation is a targeted social engineering attack vector used by red teams to gain initial access. Unlike broad phishing campaigns, spearphishing uses OSINT-derived intelligence to craf
Best use case
conducting-spearphishing-simulation-campaign is best used when you need a repeatable AI agent workflow instead of a one-off prompt.
Spearphishing simulation is a targeted social engineering attack vector used by red teams to gain initial access. Unlike broad phishing campaigns, spearphishing uses OSINT-derived intelligence to craf
Teams using conducting-spearphishing-simulation-campaign should expect a more consistent output, faster repeated execution, less prompt rewriting.
When to use this skill
- You want a reusable workflow that can be run more than once with consistent structure.
When not to use this skill
- You only need a quick one-off answer and do not need a reusable workflow.
- You cannot install or maintain the underlying files, dependencies, or repository context.
Installation
Claude Code / Cursor / Codex
Manual Installation
- Download SKILL.md from GitHub
- Place it in
.claude/skills/conducting-spearphishing-simulation-campaign/SKILL.mdinside your project - Restart your AI agent — it will auto-discover the skill
How conducting-spearphishing-simulation-campaign Compares
| Feature / Agent | conducting-spearphishing-simulation-campaign | Standard Approach |
|---|---|---|
| Platform Support | Not specified | Limited / Varies |
| Context Awareness | High | Baseline |
| Installation Complexity | Unknown | N/A |
Frequently Asked Questions
What does this skill do?
Spearphishing simulation is a targeted social engineering attack vector used by red teams to gain initial access. Unlike broad phishing campaigns, spearphishing uses OSINT-derived intelligence to craf
Where can I find the source code?
You can find the source code on GitHub using the link provided at the top of the page.
SKILL.md Source
# Conducting Spearphishing Simulation Campaign > **Legal Notice:** This skill is for authorized security testing and educational purposes only. Unauthorized use against systems you do not own or have written permission to test is illegal and may violate computer fraud laws. ## Overview Spearphishing simulation is a targeted social engineering attack vector used by red teams to gain initial access. Unlike broad phishing campaigns, spearphishing uses OSINT-derived intelligence to craft highly personalized messages targeting specific individuals. This skill covers developing pretexts, building payloads, setting up email infrastructure, executing the campaign, and tracking results. ## When to Use - When conducting security assessments that involve conducting spearphishing simulation campaign - When following incident response procedures for related security events - When performing scheduled security testing or auditing activities - When validating security controls through hands-on testing ## Prerequisites - Familiarity with red teaming concepts and tools - Access to a test or lab environment for safe execution - Python 3.8+ with required dependencies installed - Appropriate authorization for any testing activities ## Objectives - Develop convincing pretexts tailored to specific target personnel - Create weaponized payloads that bypass email security controls - Set up email delivery infrastructure with proper SPF/DKIM/DMARC configuration - Execute phishing campaigns with real-time tracking and metrics - Document results for engagement reporting and security awareness improvement ## MITRE ATT&CK Mapping - **T1566.001** - Phishing: Spearphishing Attachment - **T1566.002** - Phishing: Spearphishing Link - **T1566.003** - Phishing: Spearphishing via Service - **T1598.003** - Phishing for Information: Spearphishing Link - **T1204.001** - User Execution: Malicious Link - **T1204.002** - User Execution: Malicious File - **T1608.001** - Stage Capabilities: Upload Malware - **T1608.005** - Stage Capabilities: Link Target - **T1583.001** - Acquire Infrastructure: Domains - **T1585.002** - Establish Accounts: Email Accounts ## Workflow ### Phase 1: Pretext Development 1. Review OSINT findings for target personnel profiles 2. Identify current organizational events (mergers, projects, new hires) 3. Select pretext theme (IT helpdesk, HR benefits, vendor communication, executive request) 4. Craft email templates with appropriate urgency and authority cues 5. Create landing pages that mirror target organization's branding ### Phase 2: Payload Development 1. Select payload type based on target security controls: - HTML smuggling for email gateway bypass - Macro-enabled documents (if macros not blocked) - ISO/IMG files containing LNK payloads - OneNote files with embedded scripts - QR codes linking to credential harvesting pages 2. Test payload against target's known security stack 3. Implement payload obfuscation techniques 4. Configure callback to C2 infrastructure ### Phase 3: Infrastructure Setup 1. Register convincing look-alike domain 2. Age domain and build reputation (minimum 2 weeks recommended) 3. Configure SPF, DKIM, and DMARC records 4. Set up SMTP relay with GoPhish or custom mail server 5. Deploy credential harvesting pages with SSL certificates 6. Configure tracking pixels and click tracking ### Phase 4: Campaign Execution 1. Send test emails to verify delivery and rendering 2. Launch campaign in waves (avoid mass sending) 3. Monitor email delivery rates and opens in real-time 4. Track link clicks and credential submissions 5. Deploy payloads to users who interact with phishing emails 6. Capture screenshots and evidence for reporting ### Phase 5: Post-Campaign Analysis 1. Calculate campaign metrics (delivery rate, open rate, click rate, credential capture rate) 2. Identify users who reported phishing to SOC 3. Document bypass of email security controls 4. Map successful compromises to MITRE ATT&CK 5. Compile findings for engagement report ## Tools and Resources | Tool | Purpose | License | |------|---------|---------| | GoPhish | Phishing campaign management | Open Source | | Evilginx2 | Real-time credential harvesting with MFA bypass | Open Source | | King Phisher | Phishing campaign toolkit | Open Source | | SET (Social Engineering Toolkit) | Multi-vector social engineering | Open Source | | Modlishka | Reverse proxy phishing | Open Source | | CredSniper | Credential harvesting framework | Open Source | | Fierce Phish | Phishing framework | Open Source | ## Validation Criteria - [ ] Pretext tailored to specific targets with OSINT data - [ ] Payload tested against email security controls - [ ] Infrastructure configured with proper email authentication - [ ] Campaign tracked with delivery and interaction metrics - [ ] Evidence collected for engagement report - [ ] Cleanup performed on infrastructure post-campaign
Related Skills
performing-supply-chain-attack-simulation
Simulate and detect software supply chain attacks including typosquatting detection via Levenshtein distance, dependency confusion testing against private registries, package hash verification with pip, and known vulnerability scanning with pip-audit.
performing-phishing-simulation-with-gophish
GoPhish is an open-source phishing simulation framework used by security teams to conduct authorized phishing awareness campaigns. It provides campaign management, email template creation, landing pag
performing-csrf-attack-simulation
Testing web applications for Cross-Site Request Forgery vulnerabilities by crafting forged requests that exploit authenticated user sessions during authorized security assessments.
performing-bandwidth-throttling-attack-simulation
Simulates bandwidth throttling and network degradation attacks using tc, iperf3, and Scapy in authorized environments to test quality-of-service controls, application resilience, and network monitoring detection of traffic manipulation attacks.
performing-arp-spoofing-attack-simulation
Simulates ARP spoofing attacks in authorized lab or pentest environments using arpspoof, Ettercap, and Scapy to demonstrate man-in-the-middle risks, test network detection capabilities, and validate ARP inspection countermeasures.
hunting-for-spearphishing-indicators
Hunt for spearphishing campaign indicators across email logs, endpoint telemetry, and network data to detect targeted email attacks.
executing-phishing-simulation-campaign
Executes authorized phishing simulation campaigns to assess an organization's susceptibility to email-based social engineering attacks. The tester designs realistic phishing scenarios, builds credential harvesting infrastructure, sends targeted phishing emails, and tracks open rates, click-through rates, and credential submission rates to measure human security awareness. Activates for requests involving phishing simulation, social engineering assessment, email security testing, or security awareness measurement.
executing-active-directory-attack-simulation
Executes authorized attack simulations against Active Directory environments to identify misconfigurations, weak credentials, dangerous privilege paths, and exploitable trust relationships that could lead to domain compromise. The tester uses BloodHound for attack path analysis, Mimikatz for credential extraction, and Impacket for protocol-level attacks including Kerberoasting, AS-REP Roasting, and delegation abuse. Activates for requests involving Active Directory pentest, AD attack simulation, domain compromise testing, or Kerberos attack assessment.
detecting-spearphishing-with-email-gateway
Spearphishing targets specific individuals using personalized, researched content that bypasses generic spam filters. Email security gateways (SEGs) like Microsoft Defender for Office 365, Proofpoint,
correlating-threat-campaigns
Correlates disparate security incidents, IOCs, and adversary behaviors across time and organizations to identify unified threat campaigns, attribute them to common threat actors, and extract shared indicators for improved detection. Use when multiple incidents exhibit overlapping indicators, when sector-wide attack campaigns require cross-organizational analysis, or when building campaign-level intelligence products. Activates for requests involving campaign analysis, incident clustering, cross-organizational IOC correlation, or MISP correlation engine.
conducting-wireless-network-penetration-test
Conducts authorized wireless network penetration tests to assess the security of WiFi infrastructure by testing for weak encryption protocols, captive portal bypasses, evil twin attacks, WPA2/WPA3 handshake capture, rogue access point detection, and client-side attacks. The tester evaluates wireless authentication, network segmentation, and the effectiveness of wireless intrusion detection systems. Activates for requests involving wireless pentest, WiFi security assessment, WPA2/WPA3 testing, or rogue access point detection.
conducting-social-engineering-pretext-call
Plan and execute authorized vishing (voice phishing) pretext calls to assess employee susceptibility to social engineering and evaluate security awareness controls.